International Business Machines Corporation

Disney Enterprises, Inc.

Robert K Floyd, Iii

Robert P Monaco

Baiju Dhirajlal Mandalia

Mahesh Viswanathan

James W Ling

Catalin Dumitru Marica

Roger Hoffmann

Ruchi Mahindru

Richard Edwin Harper

Jeffrey Sol Mansukhani

Stephen Sauer

Joseph D Robinson

Sean Donnellan

Mark G Cloud

Sankara Subramanyam

Marian Tudosoiu

Daniel Eric Ouellette

James Reed Philpott

Esther M Betancourt

Hsiu Lan Chen

Liviu Tudorache

Holger Mueller

Various embodiments set forth systems and techniques for identifying issues associated with a domain name system (DNS) ecosystem. The techniques include receiving a first target domain name; identifying a plurality of DNS elements included in the DNS ecosystem that should be tested based on the first target domain name; performing one or more validation operations on the plurality of DNS elements based on the first target domain name to generate a first set of validation results; and identifying a first DNS issue associated with the first target domain name based on the first set of validation results.

Techniques for DNS ecosystem health checks

A firewall manager periodically accesses a set of servers to identify the various services currently active on each server. The firewall manager also periodically accesses a set of firewalls configured to protect those servers to identify various firewall rules implemented by those firewalls. The firewall manager then compares the services data with the rules data to identify any obsolete firewall rules that are (i) defined based on an IP address not currently allocated to any of the servers or (ii) defined based on a port of an active server that is not associated with any service running on server. Such rules are considered obsolete. Upon identifying any obsolete firewall rules, the firewall manager accesses the firewalls associated with those rules and then removes the obsolete rules.

Firewall rule remediation for improved network security and performance

An approach is provided for protecting a network from a unicast flood. If the destination MAC address of a frame is not included in a table of unknown MAC addresses, the MAC address is added to the table and the frame is forwarded to non-blocked spanning tree links to find the MAC address in the network. If the MAC address is included in the table, and if a timer for suppressing forwarding of frames is active, the frame is discarded, or if the timer is inactive, a counter for counting received frames is incremented and compared to a threshold value. If the counter is greater than the threshold value, the timer is activated and the frame is discarded. If the counter is not greater than the threshold value, the frame is forwarded to the non-blocked spanning tree links to find the MAC address in the network.

Protecting a network from a unicast flood

Techniques for dampening an interface flapping rate between switches in a network environment. An interface of a first switch is designated as being in an active mode in which forwarding activity of the interface is permitted. The interface is determined to exhibit flapping behavior satisfying one or more dampening criteria when in the active mode. An indication is sent to a second switch to isolate the interface. A reply to the indication is received from the second switch. The interface is designated as being in an isolated mode in which health monitoring of the interface is permitted but forwarding activity of the interface is prohibited. The interface is determined to satisfy one or more reinstatement criteria when in the isolated mode. The interface is redesignated as being in the active mode.

Isolation and monitoring mode for problematic data links

Embodiments of the present invention include methods, systems, and computer program products for packet forwarding. Aspects of the invention include receiving, from a source node, a first network queue in a set of network queues, wherein the first network queue includes one or more minimum network traffic performance requirements. A set of network paths is analyzed to determine a performance level for each network path and identify a first network path and a second network path with a performance level above the one or more minimum performance requirements of the first network queue. A determination is made that the first network path has a higher performance level than the second network path. Based at least in part on determining that the first network path has a higher performance level than the second network path, the first network queue is mapped to the first network path.

Packet forwarding for quality of service delivery

An approach for regional firewall clustering for optimal state-sharing of different sites in a virtualized/networked (e.g., cloud) computing environment is provided. In a typical embodiment, each firewall in a given region is informed of its peer firewalls via a registration process with a centralized server. Each firewall opens up an Internet protocol (IP)-based communication channel to each of its peers in the region to share state table information. This allows for asymmetrical firewall flows through the network and allows routing protocols to ascertain the best path to a given destination without having to take firewall placement into consideration.

Regional firewall clustering in a networked computing environment

A method and associated systems of automatic notification of isolation of a first networked device. In response to detecting that it is not being properly managed by a network-management means, the first networked device creates a notification message that identifies the problem and requests proper network management. The device then transmits this message to any other device or networked node that it can communicate with, along with a request that recipients try to forward the message to the network-management means. If a device that receives the message is able to forward the message successfully, the network-management means takes appropriate steps to begin properly managing the first networked device.

Automatic notification of isolation

A method, computer program product, and system for adjusting network traffic balance among a plurality of communication links between a first network node and a second network node on a computing network includes a processor receiving over a computing network from a network device, performance metrics for a plurality of communications links between a first network node and a second network node on the computing network and based on receiving the performance metrics, the processor determines degradation in network performance on at least one of the plurality of communication links. The processor determines a weight for each communication link, associating a lower weight with the degraded link(s), and formulates instructions for an adjusted network traffic balance among the links, based on the weights. The processor transmits the instructions to a network device on the computing network and upon receipt of the instructions, the network device adjusts the network traffic balance among the links in accordance with the instructions.

Weighted distribution across paths of degraded quality

To provision a secure customer domain in a virtualized multi-tenant environment, a virtual machine (VM) is configured for a customer in the customer domain. A first, second, and third virtual network interfaces (VNICs) are configured in the VM. The first VNIC has a first network address within a first address range selected for the customer domain and enables an application on the VM to access a second application in a second VM in the customer domain. The second VNIC enables a third application outside the customer domain to access the VM in the customer domain. The second VNIC is configured to use an addressing specification used by a server of the third application. The third VNIC enables access from the first application to a fourth application executing outside the customer domain. The third VNIC is configured to use an addressing specification used by a server of the fourth application.

Growing community of inventors

Clermont, FL, United States of America

Robert K Floyd, Iii